{
  "@context": "https://schema.org",
  "@type": "CreativeWork",
  "name": "Sandbox Network Policy",
  "dateModified": "2026-06-02T09:39:35.503Z",
  "policies": {
    "none": "no egress, no ingress",
    "egress-allowlist": "DNS+TLS to /agent-sandbox/egress-allowlist.json only, all else DROP",
    "full": "enterprise only, audit-logged, IP-recorded"
  },
  "enforcedBy": "Cilium 1.16 NetworkPolicy + eBPF + envoy-filter"
}